PureBasic Forums - English

I have this exact query:

http://www.vbforums.com/showthread.php?t=371175

Basically it talks about "Folder Lock" and how it makes a folder totally invisible
to Explorer and also a DOS box. I'd love to do this with PureBasic, but nothing
I've tried works (eg. renaming the folder with Chr(255) and so on). Any ideas?

And I don't mean setting the folder's attribute to "Hidden" either.

the only way i can think of is by used A.D.S lik mentioned in that link, or by somehow making a 'rootkit' that intercepts certain winapi functions...

Try the code

@netfriends: Although it's a neat trick may I ask what the above code has to do with invisible folders? All it does is to temporary lock a file/folder from being modfied or deleted. And that only as long as the application is running.

@PB: The only reason why someone should need such a thing is to prevent some data, no matter what kind of, from being read/used/modified. Such as, files from a commecial application or sensible data like passwords. That right?

Anyway, as far as I'm concerned it's not possible to create a folder that is "completely" invisible, even for the operating system. Maybe I'm wrong tho'. But if you want to "protect" some specific data why not not simply encrypt it?

@PB: This is a hard thing to do, really... The best idea is to follow lexvictory's idea, and to code a driver that gets in ring0 that intercepts the findfirstfilea, findnextfilea, openfile, etc API's and manipulate the parameters. That is the only way to do it correctly. You can read this to see how this works:


http://www.purebasic.fr/english/viewtopic.php?t=23373

@netfriends: Great tip; it works well and is a cool alternative. Thanks!

@Fluid Byte: The reason I need it is to protect files from deletion. If you
encrypt such files, they can still be deleted. Also, the files can be large,
such as my MP3 folder -- encrypting over 2000 files is not the right way
to do it, as they'd also need decrypting just to hear them. So hiding the
folder, or just making it locked, is a far better and easier alternative.
But I note files within it can still be launched with RunProgram. Still, it's
a good way to stop people opening folders that they shouldn't be in.

> it's not possible to create a folder that is "completely" invisible,
> even for the operating system

Yes it is, and that's what the "Folder Lock" app does. I've tried it.

As an experiment I watched what "Folder Lock" did with FileMon (see below).
So to lock its "Locker" folder it was doing something with adding ")8$5(" to
the folder's path and playing with its attributes. Still can't work it out, though.

LOCKING:

1 3:47:30 PM Folder Lock.exe:3344 OPEN C:\Program Files\Folder Lock\Locker SUCCESS Options: Open Directory Access: All
2 3:47:30 PM Folder Lock.exe:3344 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS FileAttributeTagInformation
3 3:47:30 PM Folder Lock.exe:3344 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS FileNameInformation
4 3:47:30 PM Folder Lock.exe:3344 DELETE C:\Program Files\Folder Lock\Locker NOT EMPTY
5 3:47:30 PM Folder Lock.exe:3344 CLOSE C:\Program Files\Folder Lock\Locker SUCCESS
6 3:47:30 PM Folder Lock.exe:3344 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D
7 3:47:39 PM Folder Lock.exe:3344 DIRECTORY C:\Program Files\Folder Lock\ SUCCESS FileBothDirectoryInformation: Locker
8 3:47:39 PM Folder Lock.exe:3344 CREATE C:\Program Files\Folder Lock\Locker\)8$5( SUCCESS Options: Create Directory Access: All
9 3:47:39 PM Folder Lock.exe:3344 CLOSE C:\Program Files\Folder Lock\Locker\)8$5( SUCCESS
10 3:47:39 PM Folder Lock.exe:3344 OPEN C:\Program Files\Folder Lock\Locker\)8$5( SUCCESS Options: Open Directory Access: All
11 3:47:39 PM Folder Lock.exe:3344 QUERY INFORMATION C:\Program Files\Folder Lock\Locker\)8$5( SUCCESS FileAttributeTagInformation
12 3:47:39 PM Folder Lock.exe:3344 QUERY INFORMATION C:\Program Files\Folder Lock\Locker\)8$5( SUCCESS FileNameInformation
13 3:47:39 PM Folder Lock.exe:3344 DELETE C:\Program Files\Folder Lock\Locker\)8$5( SUCCESS
14 3:47:39 PM Folder Lock.exe:3344 CLOSE C:\Program Files\Folder Lock\Locker\)8$5( SUCCESS
15 3:47:39 PM Folder Lock.exe:3344 OPEN C:\Program Files\Folder Lock\Locker SUCCESS Options: Open Access: All
16 3:47:39 PM Folder Lock.exe:3344 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS FileAttributeTagInformation
17 3:47:39 PM Folder Lock.exe:3344 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS FileNameInformation
18 3:47:39 PM Folder Lock.exe:3344 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D
19 3:47:39 PM Folder Lock.exe:3344 SET INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS FileRenameInformation
20 3:47:39 PM Folder Lock.exe:3344 OPEN C:\Program Files\Folder Lock\Locker NOT FOUND Options: Open Directory Access: All

UNLOCKING:

1 3:50:11 PM Folder Lock.exe:3004 OPEN C:\Program Files\Folder Lock\Locker NOT FOUND Options: Open Directory Access: All
2 3:50:11 PM Folder Lock.exe:3004 OPEN C:\Program Files\Folder Lock\Locker NOT FOUND Options: Open Access: All
3 3:50:11 PM Folder Lock.exe:3004 QUERY INFORMATION C:\Program Files\Folder Lock\Locker NOT FOUND Attributes: Error
4 3:50:12 PM Folder Lock.exe:3004 OPEN C:\Program Files\Folder Lock\Locker NOT FOUND Options: Open Directory Access: All
5 3:50:12 PM Folder Lock.exe:3004 DIRECTORY C:\Program Files\Folder Lock\ NO SUCH FILE FileBothDirectoryInformation: Locker
6 3:50:12 PM Folder Lock.exe:3004 OPEN C:\Program Files\Folder Lock\Locker SUCCESS Options: Open Access: All
7 3:50:12 PM Folder Lock.exe:3004 CLOSE C:\Program Files\Folder Lock\Locker SUCCESS
8 3:50:13 PM Folder Lock.exe:3004 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D
9 3:50:13 PM Folder Lock.exe:3004 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D
10 3:50:13 PM Folder Lock.exe:3004 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D
11 3:50:13 PM Folder Lock.exe:3004 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D
12 3:50:13 PM Folder Lock.exe:3004 OPEN C:\Program Files\Folder Lock\Locker\pegtag.$s8 NOT FOUND Options: Open Access: All
13 3:50:13 PM Folder Lock.exe:3004 OPEN C:\Program Files\Folder Lock\Locker\ SUCCESS Options: Open Directory Access: All
14 3:50:13 PM Folder Lock.exe:3004 QUERY INFORMATION C:\Program Files\Folder Lock\Locker\ SUCCESS FileNameInformation
15 3:50:13 PM Folder Lock.exe:3004 DIRECTORY C:\Program Files\Folder Lock\Locker\ NO SUCH FILE FileBothDirectoryInformation: pegtag.$s8
16 3:50:13 PM Folder Lock.exe:3004 CLOSE C:\Program Files\Folder Lock\Locker\ SUCCESS
17 3:50:13 PM Folder Lock.exe:3004 DIRECTORY C:\Program Files\Folder Lock\ SUCCESS FileBothDirectoryInformation: Locker"*
18 3:50:13 PM explorer.exe:240 OPEN C:\Program Files\Folder Lock\Locker\ SUCCESS Options: Open Directory Access: All
19 3:50:13 PM explorer.exe:240 QUERY INFORMATION C:\Program Files\Folder Lock\Locker\ SUCCESS FileNameInformation
20 3:50:13 PM explorer.exe:240 DIRECTORY C:\Program Files\Folder Lock\Locker\ SUCCESS FileBothDirectoryInformation: *
21 3:50:13 PM explorer.exe:240 QUERY INFORMATION C:\Program Files\Folder Lock\Locker\ SUCCESS FileNameInformation
22 3:50:13 PM explorer.exe:240 DIRECTORY C:\Program Files\Folder Lock\Locker\ SUCCESS FileBothDirectoryInformation
23 3:50:13 PM explorer.exe:240 QUERY INFORMATION C:\Program Files\Folder Lock\Locker\ SUCCESS FileNameInformation
24 3:50:13 PM explorer.exe:240 DIRECTORY C:\Program Files\Folder Lock\Locker\ NO MORE FILES FileBothDirectoryInformation
25 3:50:13 PM explorer.exe:240 CLOSE C:\Program Files\Folder Lock\Locker\ SUCCESS
26 3:50:13 PM explorer.exe:240 OPEN C:\Program Files\Folder Lock\Locker SUCCESS Options: Open Directory Access: All
27 3:50:13 PM explorer.exe:240 DIRECTORY C:\Program Files\Folder Lock\Locker NOTIFY CLEANUP Change Notify
28 3:50:13 PM explorer.exe:240 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D
29 3:50:13 PM explorer.exe:240 DIRECTORY C:\Program Files\Folder Lock\ SUCCESS FileBothDirectoryInformation: Locker
30 3:50:13 PM explorer.exe:240 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D
31 3:50:13 PM explorer.exe:240 DIRECTORY C:\Program Files\Folder Lock\ SUCCESS FileBothDirectoryInformation: Locker
32 3:50:13 PM explorer.exe:240 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D
33 3:50:15 PM explorer.exe:240 QUERY INFORMATION C:\Program Files\Folder Lock\Locker SUCCESS Attributes: D

I have playing with FolderLock, when I try to open C:\ with WinHex it can't open it because MFT (master file table) is locked. But which method is used in FAT partitioins?

PB wrote:As an experiment I watched what "Folder Lock" did with FileMon (see below).
So to lock its "Locker" folder it was doing something with adding ")8$5(" to
the folder's path and playing with its attributes. Still can't work it out, though.

This is a similar problem that one that i accidentally has some days ago wasnt able to delete somefiles because accidentaly add some strange chars in the path.

FolderLock does that and make the folder system one, so its invisible and because the path additions its not listed when you try to list folders.

> This is a similar problem that one that i accidentally has some days ago
> wasnt able to delete somefiles

Tell me: did my "kill explorer.exe" let you delete them? Because as far as
I know, that always works with files in the way you described them (I've
had the same symptoms for undeleteable files in the past).

PB wrote:> This is a similar problem that one that i accidentally has some days ago
> wasnt able to delete somefiles

Tell me: did my "kill explorer.exe" let you delete them? Because as far as
I know, that always works with files in the way you described them (I've
had the same symptoms for undeleteable files in the past).

Nope. I tried but still same until i use the software i told there.

problem was not because file was used or locked, but for some strange characters in the name... i know because i create it and by error add as name part of what i was trying to add as content.
Strangelky, those part DO NOT show as name, but i know was there in some way and was an obstacle to delete it.

Once, using folder lock (i buy a licence 2 years ago) i had a crash or something and then i find some folder locked by folderlock, was invisible as system folder and has some strange characters as the first part of the name.

I was able to see the folder, but was not able to find it using the PB search for directory... i dont remember how i solve the problem and copy the files inside the folder but i was sucesfully to done it without folderlock because folderlock because a bug was not able to find the folder.

@netfriends: At first I praised your code, but then realised it doesn't lock the
C:\Program Files\Internet Explorer path for some reason. So maybe your tip
doesn't work for all folders?

[Update]

I'm running XP Pro. After further testing of the folder lock code, it seems that
trying to lock any folder in "C:\Program Files\" that belongs to Windows, can't
be done. For example, IE can't be locked, nor can "Windows NT" (which holds
the Windows apps of Dialer.exe, Pinball.exe, and so on). But, I can lock things
that do NOT actually belong to Windows, such as "C:\Program Files\Xerox\"
and "C:\Program Files\Cyberlink\".

This may not be a answer. But I remember in my old Dos days, we kept sensitive information in a virtual folder.
The virtual folder was actually just a large file with its own FAT and file system just like a drive would have been. Perhaps .pk3 or ISO would be acceptable today? Except it was encrypted. The only readable access was with a memory resident translator that had the correct password passed to it. This way, no access was granted to the contents even if the drive was removed or other OS bypass of drivers or such. Perhaps even today, a TSR style resident could set something in the registry so when protected virtual folders were double clicked the TSR would be invoked to manage the Virtual folder?

Sorry for the babble, but just wondering how or even feasible this would be in windows today?

PB wrote:
@Fluid Byte: The reason I need it is to protect files from deletion. If you
encrypt such files, they can still be deleted. Also, the files can be large,
such as my MP3 folder -- encrypting over 2000 files is not the right way
to do it, as they'd also need decrypting just to hear them. So hiding the
folder, or just making it locked, is a far better and easier alternative.
But I note files within it can still be launched with RunProgram. Still, it's
a good way to stop people opening folders that they shouldn't be in.

Hiding the folder purposely is a big no-no, and may be illegal in certain jurisdictions (several states sued or prosecuted Sony for it with their root-kit fiasco when Sony used $sys$ to hide folders/files/processes). Just set the folder permissions to allow your app the only access. Something else to remember also, several worms/trojans/viruses either search out or create hidden folders in which to hide their files which makes getting rid of these things especially hard to do sometimes (several such pieces of malware took advantage of the Sony root-kit hidden folders to hide their destructive payloads.)

Posted: Fri Sep 01, 2006 3:19 pm